[PrimeMcFly]

They don't provide any mitigations of the sort I was clearly referencing. Specifically, for restricting malicious code or users that already has access to the system, exploiting insecure software that was not compiled with pledge support.

[saagarjha]

What kind of mitigations would help here?

[PrimeMcFly]

SELinux/RSBAC/AppArmor/grsecurity and similar.

[saagarjha]

These largely require buy-in from applications just like pledge.

[PrimeMcFly]

They absolutely don't, that's the key difference.

What makes you think otherwise?

[saagarjha]

You can’t just stick sandboxing around arbitrary apps without them breaking.

[PrimeMcFly]

The technologies I listed are not sandboxing, as that term refers to a different category of technology.

And you're right, kind of; you need to set the permissions for apps, but that doesn't mean they need cooperation from the software developers. The whole point is that they don't. With those technologies you can lock down complex closed source programs, something not possible with pledge.